← back
CVE-2020-28978

CVE-2020-28978

EPSS 15.3%
The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/tree.php?subdomain=SSRF.
Affected products
n/a · n/a
public PoCs found — 2
cve_referencepacketstormsecurity.com/files/160358/WordPress-Canto-1.3.0-Server-Side-Request-Forgery.htmlunverifiedexploitdbwww.exploit-db.com/exploits/49189unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://packetstormsecurity.com/files/160358/WordPress-Canto-1.3.0-Server-Side-Request-Forgery.htmlhttps://gist.github.com/p4nk4jv/87aebd999ce4b28063943480e95fd9e0https://github.com/CantoDAM/Canto-Wordpress-Pluginhttps://wordpress.org/plugins/canto/#developershttps://www.canto.com/integrations/wordpress/